Insert a Policy Enforcement Point (PEP/PDP) between the agent's planning output and the tool execution layer. This middleware treats every agent-generated tool call as untrusted input and validates it against a policy before execution.

The policy checks: Does the tool call match the declared intent of this session? Are the parameters within expected schema ranges? Does this call follow an allowable sequence given what the agent just did? Has the call rate or cost budget been exceeded?

If validation fails: the call is blocked, the user is notified, and the event is logged.

Intent gates are only as good as the policies they enforce. If you haven't defined what "valid intent" looks like for this agent's task — what sequences of calls are expected, what parameters are in range — the gate has nothing to validate against. Policy definition requires deep domain knowledge of the agent's use case.

S01 (Tool Poisoning — blocked by schema validation), S04 (CRM + Email chain — blocked by sequence policy: "should a CRM read ever precede an external email?"), S09 (Loop amplification — blocked by rate policy).